Memory exhaustion via crafted zip file

[encukou]

As reported by @tonghuaroot:

zipfile.ZipExtFile._read1() bounds the output of each decompress() call for DEFLATE members (it passes a max_length to zlib), but for bzip2 / LZMA / Zstandard members it called self._decompressor.decompress(data) with no bound. A whole compressed chunk was therefore expanded into a single allocation before the data = data[:self._left] clip ran.

Linked PRs

• gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard #156003
• [3.15] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) #156362
• [3.14] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) #156737
• [3.13] gh-156002: Bound zipfile decompression for bzip2/LZMA (GH-156003) (GH-156362) #156738
• [3.12] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) #156739
• [3.11] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) #156740
• [3.10] gh-156002: Bound zipfile decompression for bzip2/LZMA/Zstandard (GH-156003) (GH-156362) #156741